Last active
December 26, 2025 15:26
-
-
Save scriptingstudio/3ab0d1a37a00de2592106ffb1d96eef8 to your computer and use it in GitHub Desktop.
Simple Windows Event Log Converter
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| function Get-EventLogInfo { | |
| [cmdletbinding()] | |
| param ([Parameter(Position=0,Mandatory,ValueFromPipeline)]$eventobject, [switch]$text) | |
| process { | |
| foreach ($item in $eventobject) { | |
| $eventData = [ordered]@{ | |
| ID = $item.Id | |
| TimeCreated = $item.TimeCreated | |
| Version = $item.Version | |
| Level = $item.Level | |
| Task = $item.Task | |
| Opcode = $item.Opcode | |
| Keywords = $item.KeywordsDisplayNames | |
| LevelDisplayName = $item.LevelDisplayName | |
| OpcodeDisplayName = $item.OpcodeDisplayName | |
| TaskDisplayName = $item.TaskDisplayName | |
| ContainerLog = $item.ContainerLog | |
| RecordId = $item.RecordId | |
| LogName = $item.LogName | |
| ComputerName = $item.MachineName | |
| ProcessId = $item.ProcessId | |
| } | |
| ([xml]$item.toxml()).event.eventData.data.foreach{if ($_.Name) {$eventData[$_.Name] = $_.'#text'}} | |
| if ($text) {$eventData['Message'] = $item.Message} | |
| [pscustomobject]$eventData | |
| } | |
| } | |
| } # END Get-EventLogInfo |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment